200H, very slow IPSec VPN remote access
![bbp](https://us.v-cdn.net/6029482/uploads/defaultavatar/nN4PAQRO7TCNP.jpg)
![](https://www.zyxel.com/library/assets/zyxel-forum/freshman_member.png)
![First Answer](https://us.v-cdn.net/6029482/uploads/badges/OV6XOPPO8V59.png)
![Fifth Anniversary](https://us.v-cdn.net/6029482/uploads/badges/BCDCTZ34UNQW.png)
![10 Comments](https://us.v-cdn.net/6029482/uploads/badges/818CA6MI9BTU.png)
![Friend Collector](https://us.v-cdn.net/6029482/uploads/badges/HNJASEUSC535.png)
USG FLEX 200H, firmware V1.20(ABWV.0)
In theory, IKEv2 IPSec VPN should be faster, but on 200H it's only a third of throughput of SSL VPN. That's with AES256 and SHA256 for both phases.
If I increase SHA to 384 or even 512 and modp to 3072 it comes to a halt. Everything will time out.
It seems like hardware-accelerated encryption doesn't work as it should with IPSec VPN.
All Replies
-
Hi @bbp,
Here are the official test report for your reference.
SSL VPN (OpenVPN) throughput
Using HTTP protocol to get 700M ZIP file from a server.
SSL VPN (AES) throughput on USG FLEX 200H with firmware 1.20 is around 131.2 Mbps.
(Security policy, Security services, BWM, DOS, Session control are disabled.)Remote access VPN IKEv2 throughput
Using HTTP protocol to get 2G ZIP file from a server.
IPSec (AES) VPN Tunnel Throughput with 1 session with firmware 1.20 is around 119.5 Mbps.
Note: USG FLEX H with uOS doesn't support hardware-accelerated.Best regards,
EmilyDon't miss this great chance to upgrade your Nebula org. For free!
0 -
A far cry from what Zyxel advertise for 200H. This is the biggest disappointment so far for uOS and there have been many.
I do understand difference between real life and benchmark results, but getting only 1/10th of advertised performance is not right by any standard.
0 -
Hi @bbp,
In the datasheet, VPN throughput 1200Mbps are UDP throughput based on a combination of 64 byte, 512 byte, and 1424 byte packet sizes. (Using IXIA)
If you run the VPN throughput by downloading a ZIP file using HTTP (It is TCP, not UDP), the result 119.5 Mbps is measured with 1 session only.
Best regards,
EmilyDon't miss this great chance to upgrade your Nebula org. For free!
0 -
Emily, can you please post the official test reports for the other USG devices (100H, 500H, 700H)?
Thank you
Regards, Holger
1
Categories
- All Categories
- 414 Beta Program
- 2.2K Nebula
- 130 Nebula Ideas
- 88 Nebula Status and Incidents
- 5.4K Security
- 166 USG FLEX H Series
- 255 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 999 Wireless
- 36 Wireless Ideas
- 6.2K Consumer Product
- 233 Service & License
- 370 News and Release
- 77 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight